Re: New Proposal for Section 11.1.3 Replay

["Joseph Galbraith" <galb-list%vandyke.com@localhost>]

> Naturally, if an
>    attacker does attempt to replay a captured packed before the peers
>    have rekeyed, then the receiver of the duplicate packet will see that
>    it has the sequence number of a packet that has already been received
>    and will discard it.

The packet sequence number is not actually sent on
the wire, but is maintained independantly by each
side.

If an attacker replays a captured packet, it will
be input into the mac routines with the next valid
sequence number.  Since that is not the sequence
number that was used in the original computation of
the mac, it will show up as a MAC error.

Thanks, Chris, for compiling these.

- Joseph